What is the CVSS score of CVE-2025-53006?

CVE-2025-53006 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PostgreSQL are affected by CVE-2025-53006?

DataEase contains a critical remote code execution vulnerability (CVE-2025-53006, CVSS 9.8) that allows unauthenticated attackers to execute arbitrary code on affected systems.. A patch is available.

Is there a public PoC exploit available for CVE-2025-53006?

Yes, a public proof-of-concept exploit is available for CVE-2025-53006. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-53006?

Within 24 hours: Identify all DataEase deployments and verify current version; isolate or restrict network access to DataEase instances. Within 7 days: Apply vendor-released patch to all affected DataEase instances and validate successful deployment. Within 30 days: Conduct security audit of DataEase systems for evidence of prior exploitation and verify no unauthorized access to analytics data occurred.

PostgreSQL CVE-2025-53006

EUVD-2025-19715 CRITICAL

Improper Neutralization of Substitution Characters (CWE-153)

2025-07-02 security-advisories@github.com

Information Disclosure PostgreSQL Dataease

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:52 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.10.11

EUVD ID Assigned

Mar 16, 2026 - 01:55 euvd

EUVD-2025-19715

Analysis Generated

Mar 16, 2026 - 01:55 vuln.today

PoC Detected

Jul 10, 2025 - 15:16 vuln.today

Public exploit code

CVE Published

Jul 02, 2025 - 15:15 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters like "socketfactory" and "socketfactoryarg", there are also "sslfactory" and "sslfactoryarg" with similar functionality. The difference lies in that "sslfactory" and related parameters need to be triggered after establishing the connection. Other similar parameters include "sslhostnameverifier", "sslpasswordcallback", and "authenticationPluginClassName". This issue has been patched in 2.10.11.